#!/bin/bash
########################################################################
# script name:  apply_security.sh
# Used for:
# Author:       Martin Dumont
# Contributors:
# Version:      0.1
#
# (date format: date +'%Y/%m/%d')
#
# Date          Version Contributors    Modifications
# ----------    ------- ------------    -------------
# 2012/03/13    0.1     MDUMONT         initial
########################################################################
usage()
{
cat << STOP

usage: $0 [options] [ARG]

This script is used for ....

OPTIONS:
   -h               All hosts (detail output)

Ex.:
$0 -h
STOP
}
#######################################
# Get parameters
#######################################
while getopts h: OPTION
do
        case $OPTION in
        h)
                HOSTS=$(echo $OPTARG | tr '[A-Z]' '[a-z]' | sed 's/,/ /g')
                ;;
        \?)
                usage
                exit 1
                ;;
        *)
                usage
                exit 1
                ;;
        esac
done
if [ $OPTIND = 1 ]; then usage; exit 1; fi
#######################################
# Variables and environnement
#######################################
SSH_OPTS=" -o ConnectTimeout=15 -o BatchMode=yes -o StrictHostKeyChecking=no -o LogLevel=quiet"
BAENV=$(dirname `which $0`)/loadenv.sh
if [ -f $BAENV ]; then . $BAENV; else echo "No env library ($BAENV)"; exit 1; fi
#######################################
# MAIN
#######################################
NEWHOSTLIST=$(checkhost $HOSTS | grep -v Verifying)
for HOSTNAME in $NEWHOSTLIST
do
	cat <<-EOF | if [ "$HOSTNAME" != "localhost" ]; then sudo -u saunix ssh $SSH_OPTS $HOSTNAME "cat | sudo bash"; else cd /tmp; cat | sudo bash; fi
		echo "Setting default in login.cfg file"
		chsec -f /etc/security/login.cfg -s default -a logindisable=3 -a logininterval=300 -a loginreenable=15
		echo "Setting default in user file"
		chsec -f /etc/security/user -s default -a maxage=13 -a histsize=10 -a maxexpired=-1 -a minalpha=1 -a mindiff=1 -a minother=1 -a pwdwarntime=7 -a umask=022
		echo "Setting root defaults"
		chsec -f /etc/security/user -s root -a maxage=0 -a minage=0 -a maxexpired=0 -a minalpha=0 -a minother=0 -a mindiff=0 -a maxrepeats=8 -a histexpire=0 -a histsize=0 -a minlen=8 -a loginretries=3
		echo "Setting shells"
		chsec -f /etc/security/login.cfg -s usw -a shells=/bin/sh,/bin/bsh,/bin/csh,/bin/ksh,/bin/tsh,/bin/ksh93,/usr/bin/sh,/usr/bin/bsh,/usr/bin/csh,/usr/bin/ksh,/usr/bin/tsh,/usr/bin/ksh93,/usr/bin/rksh,/usr/bin/rksh93,/usr/sbin/uucp/uucico,/usr/sbin/sliplogin,/usr/sbin/snappd,/usr/bin/bash,/bin/bash,/usr/bin/zsh,/bin/zsh,/bin/git-shell
		echo "Setting users defaults"
		for LOGIN in \`cat /etc/passwd | cut -d: -f1 | egrep '^b0|^k0'\`
		do
			echo -n "   Setting \$LOGIN..."
			if chsec -f /etc/security/user -s \$LOGIN -a maxage= -a histsize= -a maxexpired= -a minalpha= -a mindiff= -a minother= -a pwdwarntime= -a umask= -a loginretries=; then echo ok; fi
		done
	EOF
done
#######################################
exit 0

